Executive brief
The TRENDnet TEW-755AP wireless access point contains a command injection vulnerability in its web-based configuration interface. An attacker can send a specially crafted request to the email configuration page to execute arbitrary system commands on the device with no authentication required. This could allow an attacker to gain full control of the access point, intercept network traffic, or use it as a foothold to attack other devices on the network.
Technical details
The vulnerability is a command injection flaw (CWE-77) in the log_email_server parameter of the /cgi-bin/email.cgi endpoint, which is processed by the SSI (Server-Side Includes) component without proper sanitization. The vulnerable function log_email_server accepts user input and passes it to a shell command without filtering shell metacharacters such as semicolons and pipes. The attack is network-accessible and requires no authentication. An attacker can inject shell commands that execute with the privileges of the web server process, potentially allowing remote code execution. The exploit proof-of-concept has been publicly released.
Affected products
- TRENDnet TEW-755AP up to version 20260702
Timeline
- 2026-08-19: disclosed
- exploited: Exploit proof-of-concept publicly released